Direct Payments City of York Council Internal Audit Report 2017/18

Business Unit: Adult Social Care Responsible Officer: Assistant Director Adults and Social Care Service Manager: Head of Safeguarding & Mental Health Head of Adult Social Care Head of Customer, Resident & Exchequer Services

Date Issued: 6 April 2018 Status: Final Reference: 11480/007

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction

Direct Payments are local health and social care payments for people who have been assessed as needing help from social services and who would prefer to arrange and pay for their own care and support rather than to receive services directly from the local authority. The aim of Direct Payments is to allow the service user greater choice and control through the flexibility of being able to purchase their own care package. The Care Act (2014) mandated Direct Payments for the first time in certain circumstances, effective from April 2015. Sections 31 to 33 of the Act set out the duties of local authorities in respect of these payments.

Over £5 million in Direct Payments were made during 2016-17. As of 15 June 2017, the council has 264 Direct Payment customers. Of these 264 customers, 90 have self-managed accounts with 82 receiving payments via prepaid cards and eight receiving payments into a designated bank account. Following the move to a Personal Budget Model in October 2016, the remaining 174 customers have a managed account with a support provider on the council’s approved provider list.

Objectives and Scope of the Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system ensure that:

- Self-managed, prepaid card accounts;
- Designated personal bank accounts; and
- Accounts managed by third party support providers

are monitored and reconciled appropriately and support plans are reviewed to ensure that they continue to meet the needs of the customer.

The previous audit carried out in 2015-16 received a Limited Assurance opinion. This audit followed up the actions that were agreed to ensure that the issues and control weaknesses had been satisfactorily addressed.

Key Findings

It was found that Direct Payment accounts are not consistently monitored according to council policy. While reconciliations for managed and self-managed prepaid card accounts had been performed, they were not always timely. Reconciliations were largely accurate but some minor errors were observed with contingency items being omitted. The accounts of customers receiving their Direct Payment into a designated bank account are not subject to appropriate levels of monitoring. Just one of the nine accounts reviewed had been reconciled in line with policy and for four accounts there was no evidence available on Mosaic that any reconciliation had been performed.

Some additional weaknesses in the carrying out of monitoring processes were also observed. Newly commissioned Direct Payments are monitored more consistently than was the case at the time of the previous audit but still only half of the accounts tested had been monitored at the intervals required by the Direct Payments policy. Furthermore, account surpluses and deficits are routinely identified but are not always acted upon.

Finally, it was found that customer support plans are not routinely reviewed on an annual basis as is required by council policy with some reviews having been delayed for between four and 13 months.

**Overall Conclusions**

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 1 Timeliness of reconciliations for prepaid card accounts

| Issue/Control Weakness | Risk | |------------------------|------| | The accounts of customers with prepaid cards are not monitored in accordance with council policy. | Customers may misuse their Direct Payment or fail to pay their assessed contribution. Budget provision may be affected by the accrual of account surpluses or failure to recover funds. |

Findings

Of the ten managed accounts tested, three had not been reconciled by October 2017 and thus were delayed at the time of audit testing. A further ten self-managed accounts were tested and none of these reconciliations had been completed within 12 months of the period up to which the previous reconciliation had been performed. While reconciliations for five accounts were not significantly delayed, for the remaining five reconciliations delays were significant (more than three months for one recently completed reconciliation) or were overdue at the time of audit testing with no evidence on Mosaic that they had been performed.

Agreed Action 1.1

The scheduling of account reconciliation will be managed by the Income Services Manager. Cases will be allocated to officers one month in advance of the review date.

The working practice within Income Services has been to reconcile all accounts, including managed accounts. However, it is the responsibility of the support provider to undertake the reconciliation and delays in resolving managed account reconciliations has had the effect of delaying the commencement of self-managed account reconciliations. Income Services will no longer reconcile managed accounts.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Income Services Manager | Implemented |

## 2 Designated bank account reconciliations

| Issue/Control Weakness | Risk | |------------------------|------| | The accounts of customers who receive Direct Payments into a designated bank account are not reconciled in accordance with council policy. | Customers may misuse their Direct Payment or fail to pay their assessed contribution. Budget provision may be affected by the accrual of account surpluses or failure to recover funds. |

### Findings

Based on the data provided there were nine Direct Payment customers who received the payments into a designated bank account at the time of audit testing. For five of these accounts there were no reconciliations available on Mosaic (although one account was opened in April 2017 and so the first reconciliation was not due at the time of audit testing). A further two accounts had been reconciled most recently in 2014 and 2015. Therefore, just one account had been reconciled in accordance with the council’s Direct Payments policy.

### Agreed Action 2.1

The Direct Payments policy will be presented to the Direct Payments Group for review and clarification will be sought regarding roles and responsibilities.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Head of Service – Adult Safeguarding, DoLS, Mental Health and Learning Disabilities | May 2018 | 3 Allowance for agreed contingencies

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Agreed contingency items are not routinely accounted for in reconciliations. | Insufficient funds are available in the customer's account to be able to meet employer obligations. |

Findings

Of the 20 Direct Payment accounts tested, six did not employ a personal assistant and so a DP2 reconciliation report had not been submitted. In a further two cases, customers employed a personal assistant but had not submitted a DP2. No reconciliations were on file for one customer. This left a population of 11 accounts for which a DP2 form had been submitted and the full range of contingency costs could be reviewed. Of these 11 accounts, employers' liability insurance had not been factored into the reconciliation on four occasions despite being recorded on the DP2 form (employee holidays provided were also not factored into one of these reconciliations). More generally, support costs and other contingencies were found not to have been included on the DP2s submitted. This issue was observed in the 2015/16 audit but it is the responsibility of the customer, nominated person or support provider to provide this information.

Agreed Action 3.1

DP2s will be checked and returned to the customer, nominated person or support provider if information appears to be missing or where the DP2 and Audit Reconciliation worksheet do not match. An additional seven days will be allowed for the return of this information.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Income Services Manager | Implemented | 4 Account monitoring

| Issue/Control Weakness | Risk | |------------------------|------| | Newly commissioned Direct Payment accounts are not monitored with the frequency required by council policy. | Financial loss to the council as the Direct Payment is used to pay for items which are not included in the customer's support plan. The customer fails to manage their finances correctly and thus has insufficient funds to meet their care needs. |

Findings

Only one of the 10 accounts initially tested had been monitored at two, four and sixth months after the Direct Payment was commissioned as per the Direct Payments policy. However, all accounts had at least been monitored once within six months from commissioning and nine accounts had been monitored twice within this period. Although not fully compliant with the policy, this represents a marked improvement from the previous audit whereby no new accounts were monitored before six months after commissioning.

During the audit Income Services advised that the Direct Payment Monitoring workstep (the workflow item within the system which schedules account monitoring tasks) had not been configured until May 2017. Re-testing performed showed an increase in the performance of account monitoring from June 2017 onwards but still half of new or amended accounts had not been monitored at the frequency required by the Direct Payments policy.

Agreed Action 4.1

Action undertaken at 1.1 should go some way to improving this issue and a system will be put in place to check, on a weekly basis, that all new Direct Payments are correctly scheduled for monitoring every two months for the first six months. Approval has been obtained from the Assistant Director – Adults and Social Care and the Head of Customer, Resident & Exchequer Services to remove the requirement for intensive monitoring during the first six months where a customer has previously had a successful Direct Payment in place.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Income Services Operations Manager | Implemented | 5 Surplus reclams

| Issue/Control Weakness | Risk | |------------------------|------| | Failure of Care Management to notify Income Services on a timely basis as to whether or not account surpluses can be reclaimed. | Direct Payment accounts accrue excessive surpluses, affecting the provision of the Direct Payments budget. |

Findings

If a surplus of over £50 after contingencies remains in a Direct Payment account following reconciliation, Income Services is required to notify Care Management as per the Escalation Policy. Care Management are expected to advise Income Services as to whether or not the surplus funds can be reclaimed (and, if not, reasons must be provided) within 28 working days.

Responses to surplus notifications had been received from Care Management in seven instances of the ten identified surpluses tested. Six of these responses had been received within the 28 working day timescale while a response to one notification took 66 working days. A further two notifications had not received a response at the time of audit testing and five months have elapsed for both. In one case, Care Management was not required to send notification to Income Services as the Direct Payment had in fact ended. Therefore, three of nine surplus notifications did not receive a timely response from Care Management and, as such, surpluses have remained in the account for an extended period of time.

Agreed Action 5.1

The Direct Payments policy will be presented to the Direct Payments Group for review and clarification will be sought regarding roles and responsibilities.

| Priority | 2 | |----------|---| | Responsible Officer | Head of Service – Adult Safeguarding, DoLS, Mental Health and Learning Disabilities | | Timescale | May 2018 | 6 Communication around failure to pay customer contribution

| Issue/Control Weakness | Risk | |------------------------|------| | Failure to ensure that all customers pay their assessed contribution. | The care needs of the customer may not be able to be met if insufficient funds are in the account. |

Findings

The Direct Payment Escalation Policy requires that Income Services makes telephone contact with the customer or appointed person and then formal contact via letter where assessed contributions are not being paid. In eight of nine accounts identified as failing to pay the contribution, there was evidence to support the fact that this had been identified and challenged. However, this was not always directly to the customer (for example, a nominated person) as per the Escalation Policy and notifications to Care Management were not always provided or were not timely (after failure to pay the contribution had been confirmed following the most recent reconciliation).

The accounts of seven of the customers had not been brought up to date at the time of audit testing. Identification of non-payment will have been as long ago as November 2016 for two of these accounts. The most recent reconciliations for the five other accounts were performed in February, May and June 2017 so have not been brought up to date for between three and seven months.

Agreed Action 6.1

The Escalation Policy requires that Income Services contact the customer to discuss failure to pay their contribution. If the contribution is not paid the case is then escalated to Care Management. However, Care Management has been unwilling to accept escalated cases unless Income Services has written to the customer. This has caused significant delay in the escalation process and in the resolution of account finances.

The collection of contributions by invoice has been approved by Directorate Management Teams and is to be phased over the 2018/19 financial year to be fully implemented by 31 March 2019. All customer contributions from newly commissioned DPs will be collected by invoice from the start.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Income Services Manager | Implemented | 7 Annual support plan review

| Issue/Control Weakness | Risk | |------------------------|------| | Support plans are not routinely reviewed every 12 months. | The care needs of the customer change and the support plan is no longer appropriate or proportionate. |

Findings

For three of the 10 Direct Payment accounts tested it was observed that a review of the customer's support plan had not been undertaken on an annual basis and had in fact been significantly delayed by between four and as much as 13 months. Review of case notes and other correspondence on the customers' Mosaic files revealed that scheduling issues had been encountered by the Social Care Manager (e.g. due to customer illness) and that this had contributed to the delay in review. A further three reviews were technically delayed but each by less than one month and so these were considered acceptable. Overall, it appears that annual reviews are not always timely but that this can be complicated by difficulties experienced with scheduling meetings with customers. Nonetheless, some of the delays identified were unreasonable despite the difficulties encountered.

Agreed Action 7.1

It will be ensured that the importance of the annual support plan review is reflected in any review of the Direct Payment policy undertaken by the Direct Payments Group.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Head of Service – Adult Safeguarding, DoLS, Mental Health and Learning Disabilities | May 2018 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.